Network monitoring may provide a basis for a variety of security services, such as Intrusion Detection Systems (IDS) and Data Loss Prevention (DLP) services. Security administrators and enterprises may monitor physical network connections in a variety of ways, such as by directly tapping network cables or by placing wiretap mechanisms within network devices. Such wiretap mechanisms may be designed to monitor and/or record data handled by specific ports within switches, routers, and other network devices.
Unfortunately, traditional methods for monitoring physical networks may be ineffective and/or unusable when applied to virtual networks. For example, virtual network connections may not have physical wires on which to place a tapping mechanism. In addition, a virtual network device may not correspond to or map to any physical network device. As a result, the virtual network device may be incompatible with network monitoring techniques designed for certain physical devices.
Furthermore, conventional methods for monitoring virtual ports may be unable to effectively monitor heavy flows of network traffic, such as the network loads within cloud-computing environments. For example, a virtual network device may facilitate access to large numbers of ports compared to physical network devices. As the size of cloud-based platforms grow, traditional virtual port-based filters (that may be based on physical filtering mechanisms) may increasingly be unable to efficiently and accurately detect security threats. Accordingly, the instant disclosure identifies and addresses a need for additional and improved systems and methods for scalable network monitoring in virtual data centers.